CVE-2025-24388

OTRS Administrative and Agent Interfaces are affected by CVE-2025-24388. A parameter injection vulnerability exists for an authenticated admin or agent user in versions before OTRS 8, impacting OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X and ((OTRS)) Community Edition 6.0.x. The issue stems from pa...

CVE-2025-4200

The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the loadview function that is called via at least three AJAX actions: 'loadmorepost', 'loadshop', and 'loadmoreproduct. This...

CVE-2025-4200

CVE-2025-4200 (Zagg theme

PT-2025-25471 · Zagg · Zagg

Name of the Vulnerable Software and Affected Versions: Zagg - Electronics & Accessories WooCommerce WordPress Theme versions up to, and including, 1.4.1 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the load view function, which i...

WordPress Traffic Monitor 3.2.2 Unauthenticated Bot Logging Disable

This repository features a Nuclei template specifically designed to detect an unauthenticated bot logging disable vulnerability in the Traffic Monitor WordPress plugin. This issue allows unauthenticated attackers to remotely disable bot logging via a vulnerable AJAX action. It affects versions up...

Malicious code in ac-ajax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6104c32d3a2365656156e83b9d2484fa03258db82702dc5c8e772a97ee067968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4922 Malicious code in ac-ajax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6104c32d3a2365656156e83b9d2484fa03258db82702dc5c8e772a97ee067968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ac-ajax

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-4840

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-4840 Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-4840: Improper Neutralization of Special Elements used in an SQL Command

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-5586

The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2025-1778

The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'artthemethemeoptionrestore' AJAX function in all versions up to, and including, 3.12.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delet...

VulnCheck KEV: CVE-2020-22208

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php...

CVE-2025-5586 WordPress Ajax Load More and Infinite Scroll <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2025-4578

The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-1778

The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'artthemethemeoptionrestore' AJAX function in all versions up to, and including, 3.12.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delet...

CVE-2025-1778

CVE-2025-1778 affects Art Theme (WordPress Theme). Root cause: missing capability check on the AJAX function arttheme_theme_option_restore, allowing authenticated attackers with subscriber-level access and above to delete the theme option. Affected versions: all up to and including 3.12.2.3. Reme...

PT-2025-24043 · WordPress · Ajax Load More/Infinite Scroll

Name of the Vulnerable Software and Affected Versions: Ajax Load More and Infinite Scroll plugin for WordPress versions up to, and including, 1.6.0 Description: The issue is related to Stored Cross-Site Scripting via the id parameter due to insufficient input sanitization and output escaping. Thi...

CVE-2025-5586: Improper Neutralization of Input During Web Page Generation

The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...